View
215
Download
1
Category
Preview:
Citation preview
SESSION ID:
#RSAC
Jim Reavis
State of Cloud Security 2016
CMI1-R03
CEOCloud Security Alliance@cloudsa
Presenter’s Company Logo – replace on
master slide
#RSAC
Agenda
What we are going to coverMarket forces pushing us into the cloud
The latest thinking on cloud computing security threats
Perspective of enterprise users on the state of cloud security
Key future trends we must monitor to keep the cloud secure
How to apply this knowledge to your own organization and the advocacy you should undertake to secure the cloud ecosystem
2
Presenter’s Company Logo – replace on
master slide
#RSAC
Tech consumerization…
Cloud & Internet of Things, changing the world
Presenter’s Company Logo – replace on
master slide
#RSAC
CSA Maxims
As IT moves into the Cloud, so must SecurityAs IT loses control of the endpoint, Cloud is the only Security optionAs the Internet of Things scales upwards, Cloudcomputing will be its data repository, application engine, provisioning system, Security platform and organizing conceptThe security industry is being “Cloudified”
Presenter’s Company Logo – replace on
master slide
#RSAC
CSA Top Threats to Cloud for 2016
7. APTs
8. Data Loss
9. Due Diligence
10. Nefarious Use and Abuse
11. Denial of Service
12. Shared Technology Issues
1. Data Breaches
2. Compromised Credentials and IAM
3. Insecure APIs
4. System and App Vulnerabilities
5. Account Hijacking
6. Malicious Insiders
https://cloudsecurityalliance.org/group/top-threats/
Presenter’s Company Logo – replace on
master slide
#RSAC
What has changed in our view of the threats?
Insufficient Identity, Credential and Access ManagementPrimary proximate cause for cloud-based data breaches
Identity systems must scale, must be granular, must be accurate at any point in time – on demand
Multifactor authentication must be pervasive
Centralized storage mechanism containing data secrets (e.g. passwords, private keys, confidential customer contact database) is an extremely high-value target for attackers
Presenter’s Company Logo – replace on
master slide
#RSAC
What has changed in our view of the threats?
Insecure Interfaces and APIs“DevOps” agile speed of development leading to carelessness
Migrating legacy apps to cloud is exposing poor practices, e.g. hardcoded credentials
Provenance of API services is unknown
“Exposed” nature of APIs make them a popular attack target
Presenter’s Company Logo – replace on
master slide
#RSAC
What keeps the Enterprise up at night?
Presenter’s Company Logo – replace on
master slide
#RSAC
Cloud in the Enterprise 2016
Awareness: Capturing data on current cloud usage within organization
Opportunistic: Identifying strong cloud adoption opportunities (Cloud First!)
Strategic: Building cloud adoption program – security program, architecture, frameworks & business alignment
IaaS driving purpose-built cloud apps & the “cloudified” infosec programTackling new trends catalyzed by cloudUnderstanding service-driven ITVirtualizing the DCIRON: Internet Routed Only Networks
Presenter’s Company Logo – replace on
master slide
#RSAC
CSA Global Enterprise Advisory Board to the rescue!
Announced at CSA Summit @ RSAChaired by Vinay Patel, Head of Security, Citi Infrastructure, CitigroupPublic facing, demonstrate enterprise support of CSA publiclyIssue public “Calls to action” for industryAdvise CSA on strategyIssue annual “State of Cloud Security” report
https://cloudsecurityalliance.org/download/state-of-cloud-security-2016/Charter members so far: BP, Citigroup, Johnson & Johnson, Caterpillar, Hertz, Lucasfilm, ADP, AIG, Coca Cola, United Healthcare
Presenter’s Company Logo – replace on
master slide
#RSAC
Are Cloud Providers Secure?
Uneven: Terrific Tier 1 Cloud Provider Security coexists with Poor and Unknown Provider Security
Discrimination is critical
Secure Provider + Mature Customer may not equal secure relationshipPoor Integration & Alignment, e.g. Bring Your Own KeysCommunication Gaps, e.g. sharing event infoEnterprises want a holistic risk-based view of IT with Cloud as a seamless extension
Greater transparency will help enterprises close the gaps
Presenter’s Company Logo – replace on
master slide
#RSACCloud Providers Must Make Cooperation a Priority
Threat intelligence and incident sharingTransparency on verifiable controls with strong integrity checksStandards development on common security requirementsSupport for multi-vendor enterprise: CSA enterprise users average over 1,000 unique cloud services!
Presenter’s Company Logo – replace on
master slide
#RSACCloud is Changing the Very Nature of Information Security
Servers are Dead, Long Live Services!APIs, Automation, Agility, Disposable Infrastructure SDN, IoT, Analytics, Cloud Access Security BrokersBetter Ways to Handle Old Problems
Presenter’s Company Logo – replace on
master slide
#RSACNational, Regional & Industry-Specific Regulations Provide Important Challenges
Policies rapidly outdated by technology changesDuplicative nature of many regulationsConflicting regulationsGlobal nature of enterprises and cloud providers vs regional regulatory authoritiesKnowledge gaps for regulators and auditors in addressing cloud computingData sovereignty a difficult issue with multi-national corpsEngagement with Regulatory Decision Makers Key!
Presenter’s Company Logo – replace on
master slide
#RSAC
Industry Skills Gap
One million unfilled information security jobsLagging skillsets among the employed
Presenter’s Company Logo – replace on
master slide
#RSAC
How do we move forward?
Presenter’s Company Logo – replace on
master slide
#RSAC
Fight the legacy mindset!
Security professionals bring an existing mindset to cloud securityAV, IDS, Patch management, Forensics must be done differently in cloud
Traditional datacenters are relatively staticClouds change constantly
Network security solutions assume an appliance access to trafficCloud traffic traverses hypervisors, SDN
Security operations centers (SOCs) assume ability to instrument IT systemsCloud solutions may not have an agent or logfile access for your SIEM
Presenter’s Company Logo – replace on
master slide
#RSAC
What have leading organizations learned?
Due diligence is critical – ask the provider the right questions
Understanding different types of Clouds and your Role
Identity is very important
Forcing legacy tools & architectures on cloud security problems doesn’t work
Heavy-handed blocking of cloud services backfires on infosec
Key role of intermediaries
Scale forcing greater automation
Presenter’s Company Logo – replace on
master slide
#RSAC
What are leading organizations doing?
Implementing cloud security intermediaries such as CASB: Cloud Access Security Broker
Applying security to DevOps and DevOps to security“Do it yourself” scripting of orchestration tools to automate ACLs, extraction of security logs, scaling up of secure machine images
Progressive Identity & AAA strategies
Mandating IT security professionals upgrade their skillset
Engaging regulators to create a reasonable path to cloud
Security as a Service!
Presenter’s Company Logo – replace on
master slide
#RSAC
CSA STAR Provider Assurance
Largest cloud assurance program worldwide
Managed by CSA, delivered by leading ISO certification bodies & audit firms
Widely accepted by industry & gov’t
Presenter’s Company Logo – replace on
master slide
#RSAC
Mad Skillz are Good Too!
Combining vendor neutral cloud security skills with platform-specific knowledge
Investigating next generation container and microservice tools
Many IT security professionals enhancing (sometimes “dusting off”) coding skills to build
Be Hands On!
Presenter’s Company Logo – replace on
master slide
#RSAC
What does the future look like?
Presenter’s Company Logo – replace on
master slide
#RSAC
Is the Virtual Machine an enduring atomic unit of cloud?
Presenter’s Company Logo – replace on
master slide
#RSAC
What are the possibilities of Blockchain?
Far beyond Bitcoin
Distributed immutable logging has interesting applications
Financial services looking into marrying with traditional currencies
Applies to cloud auditing and assurance programs
Building “web of trust” with IoTdevices
Presenter’s Company Logo – replace on
master slide
#RSAC
Quantum Safe Computing
NASA demonstrates quantum computer in December
How long will our commercial cryptosystems be safe?New cryptosystems take years to develop
Presenter’s Company Logo – replace on
master slide
#RSAC
Autonomic Computing
Sensing, Adaptive, Self-Optimizing
Monitor-Analyze-Plan-Execute architecture
Moving humans to the periphery when they can’t keep up
Presenter’s Company Logo – replace on
master slide
#RSAC
Artificial Intelligence
Presenter’s Company Logo – replace on
master slide
#RSAC
Do we need a sense of urgency of the future?
Humans cannot scale with the dual growth of Cloud + IoT
Technology breakthroughs may threaten existing security best practices
It takes a long time to perfect security best practices (e.g., designing a new cryptosystem)
Developers driving innovation and dictating the future
Presenter’s Company Logo – replace on
master slide
#RSAC
How do you apply this to your organization?
Realize you are not going to the cloud – you are already there
Be demanding in your due diligenceAsk your providers the necessary questions – CSA STAR is an excellent model – demand transparencyEngage internal audit and regulators to educate them on cloud
Visibility – if providers don’t have logging & APIs, approximate it (e.g. CASB)
Strong Identity Strategy (multi-factor, granular, realtime, microsecond integrity)
Educate yourself, your staff on the latest (DevSecOps, Containers, Blockchain, AI, etc)
Influence the future, it is coming fast!
29
SESSION ID:
#RSAC
Jim Reavis
THANK YOU!State of Cloud Security 2016
CMI1-R03
CEOCloud Security Alliance@cloudsa
Recommended